Skip to main content
NOPE
In Effect Standard AI Safety

ISO 42001

ISO/IEC 42001:2023 — AI Management Systems

First certifiable international standard for AI management systems. Uses Plan-Do-Check-Act methodology. Third-party certification available; major AI systems have achieved certification.

Jurisdiction

International

Enacted

Pending

Effective

Dec 18, 2023

Enforcement

TBD

ISO

Why It Matters

Becoming de facto compliance demonstration mechanism. Organizations align with EU AI Act using ISO 42001 for risk assessments.

Recent Developments

Microsoft 365 Copilot, AWS, Google Cloud have achieved certification. Increasingly used as "audit language" in procurement.

At a Glance

Who Must Comply

  • Organizations seeking AI management system certification

Obligations fall on:

Safety Provisions

  • AI policy and objectives
  • Risk assessment processes
  • Controls for AI-specific risks
  • Monitoring and measurement
  • Continual improvement

View on map

International

Focus Areas

Algorithmic accountability

Cite This

APA

International. (2023). ISO/IEC 42001:2023 — AI Management Systems.

Related Regulations

In Effect INTL

ISO 23894

AI risk management guidance complementing ISO 31000. Lifecycle risk management; audit/procurement language.

In Effect INTL

UNESCO AI Ethics

Global normative framework adopted by all 193 UN Member States. Policy Area 8 (Health and Social Wellbeing) directly addresses mental health AI.

In Effect INT

OECD AI Due Diligence

Non-binding OECD guidance applying the OECD's six-step responsible business conduct (RBC) due-diligence process to enterprises across the AI value chain, providing practical recommendations for identifying, preventing, mitigating, and accounting for adverse human-rights and societal impacts of AI systems.

In Effect INT

UN/ITU AI & Child Rights Statement

Non-binding multilateral statement signed by thirteen UN and international organisations setting out principles for protecting children's rights in the design, deployment, and governance of AI systems, including provisions on harmful content, age assurance, transparency, and child-rights impact assessments.

Enacted US-CA

CA SB 1276

Amends California's sexual-exploitation-of-a-child offence (Penal Code Section 311.3) so that it covers digitally altered or artificial-intelligence-generated matter depicting a person under 18 engaged in sexual conduct, and adds knowingly downloading, streaming or accessing such matter through electronic or digital media to the prohibited conduct. It makes the same extension to the definition of sexual exploitation that triggers mandated reporting under the Child Abuse and Neglect Reporting Act (Section 11165.1).

Enacted US-CA

CA SB 503

Requires developers and deployers of AI clinical decision support systems used by health facilities, clinics and physician practices to make reasonable efforts to identify systems with a known or reasonably foreseeable risk of biased impacts on people with protected characteristics. Developers must mitigate those risks and give deployers an intended-use and risk statement plus documentation on training data, evaluation and data governance; deployers must regularly monitor the systems and mitigate.

All regulations See what's likely relevant to your deployment

Last updated January 22, 2026. Verify against primary sources before relying on this information.